Maven/io.netty:netty-codec-smtp CVE-2025-59419: medium 5.5, EPSS 1.55%
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
Action: Upgrade io.netty:netty-codec-smtp to 4.1.128.Final (4.1.x) or 4.2.7.Final (4.2.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.2.0.Alpha1 | 4.2.7.Final | - |
| 0 | 4.1.128.Final | - |
Fixed versions
| 4.2.7.Final | 4.1.128.Final |
Sources
- osv: GHSA-jq43-27x9-3v86
- nvd: CVE-2025-59419
- https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
- https://github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120
- https://github.com/netty/netty/commit/2b3fddd3339cde1601f622b9ce5e54c39f24c3f9
- https://gist.github.com/DepthFirstDisclosures/ddacca28cb94b48fa8ab998cef59ed8c
- https://github.com/netty/netty
- https://www.depthfirst.com/post/our-ai-agent-found-a-netty-zero-day-that-bypasses-email-authentication-the-story-of-cve-2025-59419
CVE-2025-59419 · published · modified · JSON